Add opt-in Plasma fingerprint workaround

2026-09-04 23:16:15 +00:00
parent 810c8caf74
commit 19df3c3a75
16 changed files with 920 additions and 0 deletions
@@ -0,0 +1,108 @@
+%{!?upstream_version:%global upstream_version 6.7.4}
+%{!?base_release:%global base_release 1}
+%{!?workaround_release:%global workaround_release 5}
+
+Name:           kscreenlocker
+Version:        %{upstream_version}
+Release:        %{base_release}%{?dist}.ajp%{workaround_release}
+Summary:        Library and components for secure lock screen architecture
+
+License:        BSD-3-Clause AND CC0-1.0 AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND (GPL-2.0-only OR GPL-3.0-only) AND (LGPL-2.1-only OR LGPL-3.0-only)
+URL:            https://invent.kde.org/plasma/%{name}
+Source0:        https://download.kde.org/stable/plasma/%{version}/%{name}-%{version}.tar.xz
+Source1:        restart-fprintd-after-resume
+
+Patch0:         0001-dont-cancel-authentication-on-suspend.patch
+Patch1:         0002-allow-retrying-noninteractive-authentication.patch
+Patch2:         0003-allow-retry-after-transient-auth-unavailability.patch
+Patch3:         0004-retry-transient-unavailability-for-fingerprint-only.patch
+
+# Marks packages that the controller may install and records the Fedora build
+# on which the patches were based.
+Provides:       plasma-fingerprint-workaround-payload = 1
+Provides:       plasma-fingerprint-workaround-base = %{version}-%{base_release}%{?dist}
+Provides:       kscreenlocker = %{version}-%{base_release}%{?dist}
+
+# Help upgrades; kscreenlocker was split from plasma-workspace in Plasma 5.5.
+Conflicts:      plasma-workspace < 5.5
+
+BuildRequires:  cmake(LayerShellQt)
+BuildRequires:  perl-generators
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtbase-private-devel
+BuildRequires:  cmake(Qt6Quick)
+BuildRequires:  kf6-rpm-macros
+BuildRequires:  extra-cmake-modules
+BuildRequires:  cmake(KF6Crash)
+BuildRequires:  cmake(KF6GlobalAccel)
+BuildRequires:  cmake(KF6I18n)
+BuildRequires:  cmake(KF6IdleTime)
+BuildRequires:  cmake(KF6KCMUtils)
+BuildRequires:  cmake(KF6KIO)
+BuildRequires:  cmake(KF6Notifications)
+BuildRequires:  cmake(KF6Screen)
+BuildRequires:  cmake(KF6Solid)
+BuildRequires:  cmake(KF6Svg)
+BuildRequires:  cmake(KF6XmlGui)
+BuildRequires:  cmake(KF6GuiAddons)
+BuildRequires:  cmake(KF6KirigamiPlatform)
+BuildRequires:  libX11-devel
+BuildRequires:  xcb-util-keysyms-devel
+BuildRequires:  wayland-devel
+BuildRequires:  pkgconfig(xi)
+BuildRequires:  pkgconfig(xcb-event)
+BuildRequires:  cmake(PlasmaQuick)
+BuildRequires:  libXcursor-devel
+BuildRequires:  pam-devel
+
+%description
+%{summary}.
+
+This experimental Fedora 44 build contains local fingerprint authentication
+workarounds. It has not received the security review of Fedora's package.
+
+%package devel
+Summary:        Development files for %{name}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+
+%description devel
+The %{name}-devel package contains libraries and header files for developing
+applications that use %{name}.
+
+%prep
+%autosetup -p1
+
+%build
+%cmake_kf6
+%cmake_build
+
+%install
+%cmake_install
+install -D -m 0755 %{SOURCE1} \
+    %{buildroot}%{_prefix}/lib/systemd/system-sleep/restart-fprintd-after-resume
+
+%find_lang %{name} --with-qt --all-name
+
+%files -f %{name}.lang
+%license COPYING
+%{_kf6_libdir}/libKScreenLocker.so.*
+%{_kf6_datadir}/knotifications6/*.notifyrc
+%{_libexecdir}/kscreenlocker_greet
+%dir %{_kf6_datadir}/ksmserver/
+%{_kf6_datadir}/ksmserver/screenlocker/
+%{_kf6_datadir}/applications/kcm_screenlocker.desktop
+%{_kf6_qtplugindir}/plasma/kcms/systemsettings/kcm_screenlocker.so
+%{_kf6_datadir}/qlogging-categories6/kscreenlocker.categories
+%{_prefix}/lib/systemd/system-sleep/restart-fprintd-after-resume
+
+%files devel
+%{_kf6_libdir}/libKScreenLocker.so
+%{_kf6_libdir}/cmake/ScreenSaverDBusInterface/
+%{_kf6_libdir}/cmake/KScreenLocker/
+%{_includedir}/KScreenLocker/
+%{_datadir}/dbus-1/interfaces/*.xml
+
+%changelog
+* Fri Sep 04 2026 Anton - 6.7.4-1.fc44.ajp5
+- Package the fprintd resume hook and compatibility metadata
+- Apply the tested fingerprint retry patch set
@@ -0,0 +1,68 @@
+From: Alex Sanchez-Stern <alex@dmodel.ai>
+Subject: [PATCH] Don't cancel in-progress authentication on suspend
+
+Aborting an in-progress PAM conversation when the system suspends makes
+pam_authenticate() report a failure. The greeter then displays a failed
+login on resume, and authentication backends such as fingerprint can be
+left unusable for the remainder of that lock-screen session.
+
+Leave the conversation parked across suspend and resume instead. This is
+the change proposed upstream in KScreenLocker merge request 340, adapted
+to the Plasma 6.7.4 source shipped by Fedora 44.
+---
+ greeter/greeterapp.cpp | 6 ------
+ greeter/greeterapp.h   | 2 --
+ 2 files changed, 8 deletions(-)
+
+diff --git a/greeter/greeterapp.cpp b/greeter/greeterapp.cpp
+index b1de459..08d8134 100644
+--- a/greeter/greeterapp.cpp
+++ b/greeter/greeterapp.cpp
+@@ -10,8 +10,6 @@ SPDX-License-Identifier: GPL-2.0-or-later
+ #include "shell_integration.h"
+ #include "wallpaper_integration.h"
+
+-#include "../logind.h"
+-
+ #include <config-kscreenlocker.h>
+ #include <iostream>
+ #include <unistd.h>
+@@ -133,7 +131,6 @@ UnlockApp::UnlockApp(int &argc, char **argv)
+     , m_graceTime(0)
+     , m_noLock(false)
+     , m_shellIntegration(new ShellIntegration(this))
+-    , m_logindIntegration(new LogindIntegration(this))
+ {
+     auto interactive = std::make_unique<PamAuthenticator>(QStringLiteral(KSCREENLOCKER_PAM_SERVICE), KUser().loginName());
+     std::vector<std::unique_ptr<PamAuthenticator>> noninteractive;
+@@ -142,9 +139,6 @@ UnlockApp::UnlockApp(int &argc, char **argv)
+     noninteractive.push_back(
+         std::make_unique<PamAuthenticator>(QStringLiteral(KSCREENLOCKER_PAM_SMARTCARD_SERVICE), KUser().loginName(), PamAuthenticator::Smartcard));
+     m_authenticators = new PamAuthenticators(std::move(interactive), std::move(noninteractive), this);
+-    connect(m_logindIntegration, &LogindIntegration::prepareForSleep, m_authenticators, [this] {
+-        m_authenticators->cancel();
+-    });
+     initialize();
+
+     if (KWindowSystem::isPlatformX11()) {
+diff --git a/greeter/greeterapp.h b/greeter/greeterapp.h
+index 2362dd2..ff355de 100644
+--- a/greeter/greeterapp.h
+++ b/greeter/greeterapp.h
+@@ -25,7 +25,6 @@ class QuickViewSharedEngine;
+ }
+
+ class Authenticator;
+-class LogindIntegration;
+
+ struct org_kde_ksld;
+
+@@ -94,6 +93,5 @@ private:
+
+     KPackage::Package m_wallpaperPackage;
+     ShellIntegration *m_shellIntegration;
+-    LogindIntegration *m_logindIntegration;
+ };
+ } // namespace
+--
+2.51.0
@@ -0,0 +1,30 @@
+From: Anton Partanen
+Subject: [PATCH] Allow retrying non-interactive authentication
+
+An active password conversation should not prevent a completed fingerprint
+conversation from being started again. PamAuthenticator::tryUnlock() already
+ignores authenticators that are still running, so let subsequent start
+requests reach each authenticator.
+
+This is a minimal backport of the state-guard removal in upstream commit
+a5ed9ca0. It allows a fingerprint attempt interrupted by suspend to restart
+without cancelling the password conversation.
+---
+ greeter/pamauthenticators.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/greeter/pamauthenticators.cpp b/greeter/pamauthenticators.cpp
+index 7c53b73..f60516d 100644
+--- a/greeter/pamauthenticators.cpp
+++ b/greeter/pamauthenticators.cpp
+@@ -141,7 +141,7 @@ PamAuthenticators::AuthenticatorsState PamAuthenticators::state() const
+
+ void PamAuthenticators::startAuthenticating()
+ {
+-    if (d->state == AuthenticatorsState::Authenticating || d->graceLocked) {
+    if (d->graceLocked) {
+         return;
+     }
+
+--
+2.51.0
@@ -0,0 +1,28 @@
+From: Anton Partanen
+Subject: [PATCH] Allow retry after transient authentication unavailability
+
+PAM_AUTHINFO_UNAVAIL is not necessarily permanent. In particular,
+pam_fprintd returns it when an active verification is interrupted by system
+suspend. Treat that result as a failed attempt so a later start request can
+retry it. Continue to cache PAM_MODULE_UNKNOWN as permanent unavailability.
+---
+ greeter/pamauthenticator.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/greeter/pamauthenticator.cpp b/greeter/pamauthenticator.cpp
+index e2011fd..bb2521f 100644
+--- a/greeter/pamauthenticator.cpp
+++ b/greeter/pamauthenticator.cpp
+@@ -176,7 +176,9 @@ void PamWorker::authenticate()
+         pam_setcred(m_handle, PAM_REFRESH_CRED);
+         /* ignore errors on refresh credentials. If this did not work we use the old ones. */
+         Q_EMIT succeeded();
+-    } else if (rc == PAM_AUTHINFO_UNAVAIL || rc == PAM_MODULE_UNKNOWN) {
+    } else if (rc == PAM_AUTHINFO_UNAVAIL) {
+        Q_EMIT failed();
+    } else if (rc == PAM_MODULE_UNKNOWN) {
+         m_unavailable = true;
+         Q_EMIT unavailabilityChanged(m_unavailable);
+     } else {
+--
+2.51.0
@@ -0,0 +1,68 @@
+From: Anton Partanen
+Subject: [PATCH] Retry transient unavailability for fingerprint only
+
+Other non-interactive authenticators, notably smartcards, also use
+PAM_AUTHINFO_UNAVAIL to report that no credential is present. Restrict the
+retry behavior to fingerprint authenticators so absent smartcards remain
+unavailable instead of repeatedly flashing in the UI.
+---
+ greeter/pamauthenticator.cpp | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/greeter/pamauthenticator.cpp b/greeter/pamauthenticator.cpp
+index bb2521f..e27e61c 100644
+--- a/greeter/pamauthenticator.cpp
+++ b/greeter/pamauthenticator.cpp
+@@ -27,7 +27,7 @@ class PamWorker : public QObject
+ {
+     Q_OBJECT
+ public:
+-    PamWorker();
+    explicit PamWorker(bool retryOnAuthInfoUnavailable);
+     ~PamWorker() override;
+     Q_DISABLE_COPY_MOVE(PamWorker)
+     void start(const QString &service, const QString &user);
+@@ -52,6 +52,7 @@ private:
+     bool m_unavailable = false;
+     bool m_inAuthenticate = false;
+     std::chrono::steady_clock::time_point m_nextAttemptAllowedTime;
+    const bool m_retryOnAuthInfoUnavailable;
+     int m_result = -1;
+     QString m_service;
+ };
+@@ -163,10 +164,11 @@ int PamWorker::converse(int n, const struct pam_message **msg, struct pam_respons
+     return PAM_SUCCESS;
+ }
+
+-PamWorker::PamWorker()
+PamWorker::PamWorker(bool retryOnAuthInfoUnavailable)
+     : QObject(nullptr)
+     , m_conv({&PamWorker::converse, this})
+     , m_nextAttemptAllowedTime(std::chrono::steady_clock::now())
+    , m_retryOnAuthInfoUnavailable(retryOnAuthInfoUnavailable)
+ {
+ }
+
+@@ -176,9 +178,9 @@ void PamWorker::authenticate()
+         pam_setcred(m_handle, PAM_REFRESH_CRED);
+         /* ignore errors on refresh credentials. If this did not work we use the old ones. */
+         Q_EMIT succeeded();
+-    } else if (rc == PAM_AUTHINFO_UNAVAIL) {
+    } else if (rc == PAM_AUTHINFO_UNAVAIL && m_retryOnAuthInfoUnavailable) {
+         Q_EMIT failed();
+-    } else if (rc == PAM_MODULE_UNKNOWN) {
+    } else if (rc == PAM_AUTHINFO_UNAVAIL || rc == PAM_MODULE_UNKNOWN) {
+         m_unavailable = true;
+         Q_EMIT unavailabilityChanged(m_unavailable);
+     } else {
+@@ -268,7 +271,7 @@ PamAuthenticator::PamAuthenticator(const QString &service, const QString &user, N
+       })
+     , m_service(service)
+     , m_authenticatorType(types)
+-    , d(new PamWorker)
+    , d(new PamWorker(types.testFlag(NoninteractiveAuthenticatorType::Fingerprint)))
+ {
+     d->moveToThread(&m_thread);
+
+--
+2.51.0
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+[ "$1" = post ] || exit 0
+systemctl --quiet is-active fprintd.service || exit 0
+
+systemctl --no-block restart fprintd.service